Information Resource Stewardship A suggested approach for managing the critical information assets of the organization

Information Resource Stewardship Is… A business framework in which all information resources (i.e., data, applications and technology) are managed intentionally, and carefully; similarly to other critical business resources.

Information Resource Stewardship Arises… Out of a strategic vision for MSU’s enterprise business systems; that they should: Make data accessible and useful for work; Provide trust (security, compliance, consistency and integrity); Be available, robust and support business continuity; Have a coherent and consistent overall design and framework; Streamline and automate business processes.

Objectives for Information Resource Stewardship Protect, maintain and secure the quality and integrity of the institution’s data Promote adherence to common standards that ensure consistency and accuracy Foster technological designs and implementations that support process integration Provide information required to make informed business decisions, at all levels of the institution Provide access to the right data by the right people at the right time

These objectives are brought together to form “The Framework” for institutional Information Resource Stewardship at MSU

“The Framework” for Institutional Information Resource Stewardship 1. Data coherence Data models Data definitions Data security and confidentiality policy Data security and confidentiality (data access) practices Network security Host system security Application and database security Physical security 2. System integration Middleware design, policies and practices Integration architecture 3. Data security and confidentiality 5. Business rules coherence 4. Records management Records management policies: paper and electronic Workflow design, policies and practices Document imaging practices Systems of record Functional data stewardship responsibility assignment 6. Data usability and business value to the user (e.g.,business intelligence, analytics, decision support) Data integrity Work process security

Data Coherence Data Coherence: Assuring the consistency, integrity and “auditability” of institutional data by adhering to best practice principles of database and system design with regard to data modeling; creating and maintaining institutional “meta-data” dictionaries and repositories; understanding and establishing formal “systems of record”; recognizing and establishing functional roles for data stewardship.

System Integration System Integration: Making data that are shared across the institution available where and when they are needed. This involves a functional understanding of the processes that require and use the data, and the articulation of the proper technical infrastructure (i.e., “middleware”) that best supports them.

Data Security & Confidentiality Data Security and Confidentiality: Developing and maintaining not only access policies and best practice standards for access, but the physical and logical security systems and platforms to ensure the safety, viability and coherence of data, and to satisfy legal and regulatory requirements.

Records Management Maintaining required information as records (digitally or on paper) over time. This involves the proper maintenance and disposition of information (records) having permanent (or long term) historical, legal, administrative or fiscal significance, and includes institutional standards for document “imaging”.

Business Rules Coherence Business Rules Coherence: Developing and maintaining the policies, practices, and procedures to create, update and use data in consistent ways.

Data Usability Data Usability and Business Value to the User: Ensuring that data are useful to people for the effective and efficient conduct of business; that data vital to useful analysis and decision support are available, robust and understandable.

Identity Management Is an excellent example of why Information Resource Stewardship is critical

Juxtaposition of Process and Data More often than not, processes exist “vertically” in an organization (as much as we try to tear down “silos”, they certainly exist and arise naturally) Data, however, cut across processes This “orthogonality” must be managed carefully. The “Framework” identifies the components that are essential to this management

Juxtaposition of Process and Data (Identity Management is a PERFECT example) Processes where identifying a person consistently is important (using Students, and a few typical Student Processes) Student Enrolmnt & Regis. Student Emplmnt Student Payroll Student ID’s Housing Identity Characteristics (NAME, DOB, PID, SSN, etc.) cut across ALL of these processes (and certainly others)

Problems Result When… This shared nature of data across processes is not recognized or managed. Think of the problems that arise when: The same student has multiple PIDS (duplicates) The same student has different names in different systems The same student has different SSN’s in different systems There are inconsistent definitions for these critical pieces of identity data There are different rules (in each system) for updating one of these critical pieces of identity data The pieces exist in multiple places (but are needed by one system)

How Could the Framework Help? Data coherence: Consistent definitions for each identity component Identification of a single source system of record for each component; where is each component (e.g., name, dob, etc.) added, maintained, and retrieved? System integration: Developing the proper technical platform for keeping core identity information (that may be maintained elsewhere), and making it available where needed and when needed (at the first possible instance? When appropriate?) Identification and linking of data from systems of record

How Could the Framework Help? (con’t) Data Security & Confidentiality Much of the core identity data are sensitive and/or confidential What should the access, and update rules be that preserve this confidentiality, but promote the effectiveness and needed efficiencies of business processes? How do we keep the data safe from intrusion? Records Management Where and how do we store our copies of these data? For how long should we retain these records, and in what form?

How Could the Framework Help? (con’t) Business Rules Coherence Development of rules for maintaining core identity data, as well as identification of where this updating will take place, when it will take place (What type of “physical” evidence is needed for proving identity? Under what conditions, for example, do we accept a name change? How do we verify a death?) These rules apply institution wide, are documented and widely communicated Data Usability Centralized identity management will ensure consistency of results (e.g., issuance of a single net ID per person) The integrity of core identity attributes is maintained and assured in each of the processes